Free Paloalto Networks PSE-SWFW-Pro-24 Practice Exams - Page 2 of 3

Question #11

Which public cloud provider requires the creation of subnets that are dedicated to Cloud NGFW endpoints?

A . Google Cloud Platform (GCP)
B . Alibaba Cloud
C . Amazon Web Services (AWS)
D . Microsoft Azure

Reveal Solution Hide Solution

Question #12

Which three tools or methods automate VM-Series firewall deployment? (Choose three.)

A . Panorama Software Firewall License plugin
B . Palo Alto Networks GitHub repository
C . Bootstrap the VM-Series firewall
D . Shared Disk Software Library folder
E . Panorama Software Library image

Reveal Solution Hide Solution

Question #13

Tags can be created for which three objects? (Choose three.)

A . Address groups
B . Dynamic NAT objects
C . External dynamic lists
D . Address objects
E . Service groups

Reveal Solution Hide Solution

Question #14

Per reference architecture, which default PAN-OS configuration should be overridden to make VM-Series firewall deployments in the public cloud more secure?

A . Intrazone-default rule action and logging
B . Interzone-default rule service
C . Interzone-default rule action and logging
D . Intrazone-default rule service

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The default interzone rule in PAN-OS is typically set to "deny." While this is generally secure, the logging is not enabled by default. In public cloud deployments, enabling logging for the interzone-default rule is crucial for visibility and troubleshooting.

Why C is correct: Overriding the action of the interzone-default rule is generally not recommended (unless you have very specific requirements). The default "deny" action is a core security principle. However, overriding the logging is essential. By enabling logging, you gain visibility into any traffic that is denied by this default rule, which is vital for security auditing and troubleshooting

connectivity issues.

Why A, B, and D are incorrect:

A: The intrazone-default rule allows traffic within the same zone by default. While logging is always good practice, it’s less critical than logging denied interzone traffic.

B: The default service for the interzone rule is "any," which is appropriate given the default action is "deny." Changing the service doesn’t inherently improve security in the context of a default deny rule.

D: Similar to B, changing the service on the intrazone rule is not the primary security concern in cloud deployments.

Palo Alto Networks

Reference: While there isn’t one specific document stating "always enable logging on the interzone-default rule in the cloud," this is a best practice emphasized in various Palo Alto Networks resources related to cloud security and VM-Series deployments.

Look for guidance in:

VM-Series Deployment Guides for your cloud provider (AWS, Azure, GCP): These guides often contain security best practices, including recommendations for logging.

Best Practice Assessment (BPA) checks: The BPA tool often flags missing logging on interzone rules as a finding.

Live Online training for VM-Series and Cloud Security: Palo Alto Networks training courses frequently emphasize the importance of logging for visibility and troubleshooting in cloud environments.

The core principle is that in cloud environments, network visibility is paramount. Logging denied traffic is a critical component of that visibility.

Question #15

Which three presales methods will help secure the technical win of software firewalls? (Choose three.)

A . Provide link to PAYG Cloud NGFW in the Azure Marketplace
B . Unsolicited proposals that disregard customer needs
C . Network Security Design workshops
D . Proof of Value (POV) product evaluations

Reveal Solution Hide Solution

Question #16

Which two statements describe the functionality of the VM-Series firewall plugin? (Choose two.)

A . The installed VM-Series firewall plugin on the VM-Series firewall can only be upgraded or deleted.
B . The Panorama plugin must be installed on the VM-Series firewall to enable communication with Panorama.
C . To use Panorama to configure public cloud VM-Series firewall integrations, the VM-Series firewall plugin must be installed on Panorama.
D . The VM-Series firewall plugin on Panorama is not built in and must be installed to enable communication and manage the environment.

Reveal Solution Hide Solution

Question #17

Which three Cloud NGFW management tasks are inherently performed by the service within AWS and Azure? (Choose three.)

A . Horizontally scaling out to meet increased traffic demand
B . Installing new content (applications and threats)
C . Installing new PAN-OS software updates
D . Blocking high-risk S2C threats in accordance with SOC2 compliance
E . Decrypting high-risk SSL traffic

Reveal Solution Hide Solution

Question #18

When using VM-Series firewall bootstrapping, which three methods can be used to install licensed content, including antivirus, applications, and threats? (Choose three.)

A . Panorama 10.2 or later to use the content auto push feature
B . Complete bootstrapping and either Azure Blob storage or Amazon S3 bucket
C . Content-Security-Policy update URL in the init-cfg.txt file
D . Custom-AMI or Azure VM image, with content preloaded
E . Panorama software licensing plugin

Reveal Solution Hide Solution

Question #19

What are three benefits of Palo Alto Networks VM-Series firewalls as they relate to direct integration with third-party network virtualization solution providers? (Choose three.)

A . Integration with Cisco ACI allows insertion of a virtual firewall and enforcement of dynamic policies between endpoint groups without the need for manual policy adjustments.
B . Integration with a third-party network virtualization solution allows management and deployment of the entire virtual network and hosts directly from Panorama.
C . Integration with Nutanix AHV allows the firewall to be dynamically informed of changes in the environment and ensures policy is applied to virtual machines (VMs) as they join the network.
D . Integration with VMware NSX provides comprehensive visibility and security of all virtualized data center traffic including intra-host ESXi virtual machine (VM) communications.
E . Integration with network virtualization solution providers allows manual deployment and management of firewall rules through multiple interfaces and front ends specific to each technology.

Reveal Solution Hide Solution

Question #20

A company that purchased software NGFW credits from Palo Alto Networks has made a decision on the number of virtual machines (VMs) and licenses they wish to deploy in AWS cloud.

How are the VM licenses created?

A . Access the AWS Marketplace and use the software NGFW credits to purchase the VMs.
B . Access the Palo Alto Networks Application Hub and create a new VM profile.
C . Access the Palo Alto Networks Customer Support Portal and request the creation of a new software NGFW serial number.
D . Access the Palo Alto Networks Customer Support Portal and create a software NGFW credits deployment profile.

Reveal Solution Hide Solution